A Board AI Dashboard That Is Always Green Is Broken

In October 2025 the EY Center for Board Matters published its reading of the proxy statements and annual reports that 80 of the Fortune 100 had filed by 31 July. Nearly half, 48 percent, cited AI risk as part of the board's oversight of risk, triple the 16 percent of a year earlier. Around 40 percent had charged at least one board committee with AI oversight, against 11 percent in 2024. What those committees are shown each quarter is a different question, and the disclosures do not answer it.

A board AI dashboard is one page of six measures, each with a named owner and a red, amber and green threshold agreed before launch. Its job is to tell directors which AI systems need a decision this quarter. My claim is narrower than most advice on the subject, and harder to accept: a page that has shown green for four quarters running should be treated as broken until someone can say when its thresholds were set and what came close to crossing them.

What boards are shown now

Board AI updates tend to fail in one of two ways. One is the technical deck: forty slides of AUC curves and latency charts that no director can act on. The other is reassurance: "adoption is strong", with no measure, no limit and no date. The first is performance art. The second is faith. Neither tells a director what to decide.

The surveys point the same way. Deloitte's Global Boardroom Program asked 695 board members and executives in 56 countries in January and February 2025. Two-thirds said their boards still have "limited to no knowledge or experience" with AI, 31 percent said AI was not on the board agenda, and 17 percent said their board takes it up at every meeting. When the National Association of Corporate Directors asked 163 people serving on public-company boards to name the single most critical factor for overseeing AI, 25 percent chose "appropriate information and metrics presented to the board", just behind director education at 26 percent.

Why the page stays green

An always-green dashboard usually has one of three faults, and none of them sits in the AI systems.

The thresholds were set after the numbers. Whoever draws the line after seeing this quarter's figure tends to draw it just beyond that figure. Google's site reliability engineers warn against this in their book's chapter on service level objectives: "Don't pick a target based on current performance." A threshold chosen that way records where the system already stood.

Averages hide the outlier. Forty models whose average accuracy sits inside the limit can include the one model that is misjudging loan applications. The board line should count the systems outside their own limits. An average hides them.

Nobody wants to carry red into the boardroom. A reporting line that is punished for amber soon stops reporting it.

Google's engineers met the false comfort of a long green run in their own services, including ones that really were that reliable. They set objectives below 100 percent on purpose and treat the gap as an "error budget" that is meant to be spent: "It's both unrealistic and undesirable to insist that SLOs will be met 100% of the time." Their book describes Chubby, an internal lock service so dependable that other teams built on it as if it could never fail. Its "high reliability provided a false sense of security." So in any quarter in which a real failure had not taken Chubby below its target, the team took it down on purpose. No board should stage AI failures. What carries over is the principle underneath: targets agreed in advance, set below perfect, and a long run of green read as a reason to look harder.

“A threshold set after the numbers arrive describes the system. It does not govern it.”

Six measures for four questions

Directors need answers to four questions: what AI do we run and how risky is it, is it working inside the limits we agreed, are we meeting our obligations, and is it worth the cost. Six measures cover them.

1. AI systems in use, by risk tier, with the share that have a current risk assessment and a named owner who can pause them.
2. Systems outside their agreed limits (accuracy, drift, override rate), and how many breached them this quarter.
3. Serious incidents, near misses and complaints or appeals from the people the systems decide about, with the days from detection to the board.
4. Governance review: median days from request to decision, how many reviews required changes or a refusal, and any system that went live without a review.
5. Each dated legal obligation that applies, with its status and owner.
6. Value delivered against the approved business case for each material initiative, with the scale-up or stop decisions due.

Each red, amber or green against thresholds the board agreed before launch; internal audit or the risk function checks the numbers once a year.

The amber triggers in the table are my opening offer to a board.

Each measure has one named executive who answers for it, which means explaining an amber, not being blamed for one. Some cells can honestly stay green for years in a well-run company: the count of systems that went live without a review should sit at zero. The four-quarter test applies to the whole page. McKinsey's advice to boards points the same way, listing "resilience indicators (such as override rates and backup drill results)" and "escalation triggers (what incidents reach the board and how fast)". NIST's AI Risk Management Framework asks for an inventory of AI systems (GOVERN 1.6), post-deployment monitoring (MANAGE 4.1) and documented incident tracking (MANAGE 4.3).

Six is a ceiling. Google's guidance has a test for each objective that a board can borrow: "if you can't ever win a conversation about priorities by quoting a particular SLO, it's probably not worth having that SLO." A measure that has not changed a board decision in a year should come off the page.

Measures 1, 2 and 4, and the near misses in measure 3, move before harm does. Incidents and value confirm it afterwards, which is why the leading measures belong at the top of the page. On 2 November 2021 Zillow reported a write-down of about $304 million on homes bought in the third quarter "at higher prices than the company's current estimates of future selling prices", and said it would wind down Zillow Offers. Its chief executive, Rich Barton, said that "the unpredictability in forecasting home prices far exceeds what we anticipated." The gap between what the company paid and its own estimates of future selling prices is measure 2. The write-down is the lagging version of the same fact. The filings do not say what Zillow's board was shown, and I make no claim about it. The point is where the amber has to sit: on the forecast error, while it is still only a forecast error.

What regulators will ask to see

Neither the EU AI Act nor the NIST framework mentions a dashboard. Both assume the measures behind one exist. Under Article 26 of the AI Act, deployers of high-risk systems "shall monitor the operation" of each one on the basis of its instructions for use, suspend it if they have reason to think it presents a risk, report serious incidents, and keep the logs it generates, to the extent they control them, for at least six months. Banks and other financial institutions meet the monitoring duty through the internal-governance rules they already follow under EU financial services law. For systems classed as high-risk under Annex III, which covers uses such as hiring, credit scoring and education, those duties apply from 2 December 2027, after the Digital Omnibus (Regulation (EU) 2026/1744) moved the date from 2 August 2026. NIST asks organisations to plan "ongoing monitoring and periodic review" of AI risk management and to decide how often that review happens (GOVERN 1.5).

A board that sees measures 1 to 3 every quarter has most of the evidence that monitoring takes place. A board that sees a green page has evidence only that someone made one.

A test for your next board meeting

Three questions take about ten minutes.

1. Count the amber cells across the last four board packs. If the count is zero, ask who set the thresholds and when.
2. Pick one threshold and ask for the date it was agreed and the name of the person who agreed it. If it was agreed once the first results were in, it was drawn around the system as it already stood.
3. Ask which measure changed a board decision in the past year. Keep the ones that did.

For the quarterly update itself, the board AI briefing template lays out the reporting slide. The red lines that should stop a system outright are a separate decision, which I cover in Nobody Tells You When to Stop an AI Deployment.

Committees, charters and proxy disclosures are arriving at speed. A board that has never seen amber has built the structure and skipped the instrument.

Sources

• EY Center for Board Matters, "Cyber and AI oversight disclosures: what companies shared in 2025", October 2025 (80 Fortune 100 filings as of 31 July 2025).
• Deloitte Global Boardroom Program, "Governance of AI: A critical imperative for today's boards, 2nd edition", 2025 (695 respondents in 56 countries, January to February 2025).
• NACD, 2025 Public Company Board Practices and Oversight Survey, AI data pack, 28 July 2025 (n=163).
• McKinsey, "The AI reckoning: How boards can evolve", 4 December 2025.
• Google, Site Reliability Engineering, chapters "Service Level Objectives" and "Embracing Risk".
• NIST, AI Risk Management Framework 1.0 (NIST AI 100-1), January 2023.
• Regulation (EU) 2024/1689 (AI Act), Article 26, Official Journal, 12 July 2024; Regulation (EU) 2026/1744 (Digital Omnibus), amending Article 113.
• Zillow Group, third-quarter 2021 results, Form 8-K exhibit 99.1, 2 November 2021.

All sources checked on 6 October 2026.

Changes on 6 October 2026. Cut from about 5,300 words to an argument. The dashboard template now lives in the board AI briefing template, with the same six measures. Removed: the "85 percent of boards" figure, which rests on an NACD table only members can read, 2024 Deloitte figures shown as current, a vendor blog's statistics, claims about what Zillow's board saw, and a download box pointing at a missing file.